cortexbot

README

Cortex bot

Simple telegram bot to check indicators' reputation based on Cortex analyzers that can be easily written for any third party feeds or your own API service.

It simply uses a password for authentication, which is probably will be changed in the future prior to a role based model.

Usage

Start bot from the source code (you can use compiled version too):

CORTEX_BOT_PASSWORD=PassphraseForAuth \
CORTEX_URL=https://your-cortex-instance \
CORTEX_API_KEY=YOUR-API-KEY \
TGBOT_API_TOKEN=TOKEN \
go run cmd/cortexbot/main.go

Work through SOCKS5 proxy

SOCKS5_URL=socks5://user:password@server:port \
CORTEX_BOT_PASSWORD=PassphraseForAuth \
CORTEX_URL=https://your-cortex-instance \
CORTEX_API_KEY=YOUR-API-KEY \
TGBOT_API_TOKEN=TOKEN \
go run cmd/cortexbot/main.go

Add bot to your contacts, enter the passphrase and here you go - submit data and wait for results.

Supported data types

By now the following data types are supported for lookup:

• Domain
• Hash
• IP
• URL
• File
• Email

PRs are welcome!

Documentation

Index

• func IsDNSName(str string) bool
• func IsHash(str string) bool
• type Client
  • func NewClient() *Client
  • func (c *Client) Auth(input *tgbotapi.Message) error
  • func (c *Client) CheckAuth(u *tgbotapi.User) bool
  • func (c *Client) Run()
• Bugs

Functions

func IsDNSName

func IsDNSName(str string) bool

IsDNSName is a modified version of function IsDNSName from https://github.com/asaskevich/govalidator/blob/master/patterns.go

func IsHash

func IsHash(str string) bool

IsHash checks if a given string is a hash BUG(ilyaglow): not supported hashes are hashes shorter 32 letters and ssdeep

Types

type Client

type Client struct {
	Bot         *tgbotapi.BotAPI
	Cortex      *cortex.Client
	Password    string
	DB          *bolt.DB
	UsersBucket string
	TLP, PAP    int
	Timeout     time.Duration
	Debug       bool
}

Client defines bot's abilities to interact with services

func NewClient

func NewClient() *Client

NewClient bootstraps the Client struct from env variables

func (*Client) Auth

func (c *Client) Auth(input *tgbotapi.Message) error

Auth handles simple password authentication of a user

func (*Client) CheckAuth

func (c *Client) CheckAuth(u *tgbotapi.User) bool

CheckAuth checks if user is allowed to interact with a bot

func (*Client) Run

func (c *Client) Run()

Run represents infinite function that waits for a message, authenticate user and process task

Notes

Bugs

• not supported hashes are hashes shorter 32 letters and ssdeep